Forum Discussion
Best Praticies for Implementing Permissions
Greetings, I'm looking for best practices in implementing Permissions in SharePoint that allows us to ensure we have protocols in place to secure PII and other confidential information.
DLP policies are good for catching data in documents or preventing data from being shared with PII with others in the company or outside your company etc. but not really prevent people from seeing the data in documents etc.
If you want to keep documents secured to certain groups at rest etc. you will want to look into the direction of sensitivity labels. You can apply labels to to documents and if you have the proper licensing can also apply these labels automatically based on logic. But these labels can have policies applied to them to prevent access etc. to these documents.
More about labels can be found here: https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-with-sensitivity-labels?view=o365-worldwide#:~:text=Common%20scenarios%20for%20sensitivity%20labels%20%20%20,Office%20fil%20...%20%207%20more%20rows%20
If you want to keep documents secured to certain groups at rest etc. you will want to look into the direction of sensitivity labels. You can apply labels to to documents and if you have the proper licensing can also apply these labels automatically based on logic. But these labels can have policies applied to them to prevent access etc. to these documents.
More about labels can be found here: https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-with-sensitivity-labels?view=o365-worldwide#:~:text=Common%20scenarios%20for%20sensitivity%20labels%20%20%20,Office%20fil%20...%20%207%20more%20rows%20
Yes, absolutely agree on Sensitivity Labels. I always begin with DLP, then look at Sensitivity labels next.
voneil - if you want to look into Sensitivity Labels in addition to DLP, you will need to ensure that you have additional licensing for it. You will need either AIP P1, EM+S E3, or M365 E3 to implement Sensitivity labelling, or if you wanted the more advanced features - which include auto labelling, and the availability of the AIP scanner to protect on-premises content, then you will need EM+S E5 or M365 E5. There was previously a separate AIP P2 subscription for this, but Microsoft have recently discontinued this one.
